Article 10 of the AI Act asks where your data came from — and the deadline has moved

The Digital Omnibus has moved the AI Act's deadlines. The Council gave final approval on 29 June 2026, it entered into force on 27 July 2026, and it stands in the Official Journal as Regulation (EU) 2026/1744. Anyone planning against an older overview is planning against a date that no longer applies.

What moved — and what did not

The third row is easily missed. The duty to disclose that someone is talking to an AI, or looking at AI-generated content, has not been deferred. Only the marking of systems already deployed gets a grace period, until 2 December 2026.

What Article 10 requires

Article 10 governs data and data governance for high-risk systems. It requires practices appropriate to the system's purpose for training, validation and testing data — and is more concrete than its reputation suggests:

• Paragraph 2(b): data collection processes and the origin of the data, and for personal data the original purpose of collection
• Paragraph 2(c): the preparation steps — annotation, labelling, cleaning, updating, enrichment, aggregation
• Paragraph 2(f) and (g): examination for possible biases, and measures to detect, prevent and mitigate them
• Paragraph 3: data sets must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete

The requirement that takes longest

Point (b) is not a question for the model. It asks where a table came from, which run loaded it, from which source, when and by whom. That is a question for the data warehouse — and anyone who cannot answer it today for their existing tables will not answer it retroactively either.

That is what sets it apart from the AI Act's other obligations. A model can be swapped, a risk assessment filed later, documentation written. The origin of data cannot be manufactured after the fact. It comes into being at the moment data is moved, or it does not come into being at all.

In practice: anyone who wants to demonstrate in December 2027 where a system's data came from has to have started recording it long before. Fifteen months is tight but workable. Fifteen weeks is not.

What this does not mean

Not every AI system is a high-risk system. Annex III lists the cases, and most everyday enterprise applications are not among them. Running an assistant for analytics does not automatically bring you under Article 10 — it does bring you under Article 50, which still applies from August 2026.

And the deferral is not a reprieve. It changes the date, not the requirement. The text of Article 10 is unchanged; what moved is when it will be enforced.

What I would do with the fifteen months

1. 1Establish which of your own systems actually fall under Annex III. The answer is often shorter than feared, and it moves the effort.
2. 2For the data sets that do, write down what is known today about their origin — and where the chain breaks. Those gaps are the actual project plan.
3. 3Record provenance as data is loaded, not in a spreadsheet alongside. A second store for evidence eventually drifts from what it is meant to prove.
4. 4Capture the original collection purpose of personal data while the people who know it are still in the building.

The fourth point is the one I see underestimated most often. The origin of a table is rarely recorded in a system. It sits in the head of someone who built the interface six years ago. Deadlines move; those people change employer.